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1 . Policy Directive Title. 

(U) Digital Evidence Policy Implementation Guide 

2. Publication Date. 

2014-01-03 

3. Effective Date. 

2014-01-03 

4. Review Date. 

2017-01-03 

5. Primary Strategic Objective. 

6. Authorities: 


(U) Title 28 Code of Federal Regulations (C.F.R) Section (§) 0.85 

7. Purpose: 

(U) To promulgate the Digital Evidence Policy Implementation Guide. 

8. Policy Statement: 

8.1 . (U) All Federal Bureau of Investigation (FBI) employees, task force members, contractors, and 
other persons assigned or detailed to the FBI must comply with the policies and procedures contained 
in the Digital Evidence Policy Implementation Guide (PG), which are consistent with the laws, rules, 
and regulations governing FBI investigations, operations, programs, and activities. (Seethe Digital 
Evidence Policy Implementation Guide for these policies and procedures.) 

8.2. (U) Any revisions, amendments, or updates to this PG must be coordinated through the Corporate 
Policy Office (CPO), the Operational Technology Division (OTD) policy officer, and other relevant 
stakeholders (as determined by CPO and OTD). Resulting changes must then be approved by OTD's 
assistant director and the executive assistant director (EAD), Science and Technology Branch, as 
appropriate. 

9. Scope: 

(U) The guidance provided by the Digital Evidence Policy Implementation Guide is intended for all FBI 
employees, task force members, contractors, and other persons assigned or detailed to the FBI. 

1 0. Proponent: 

(U) Operational Technology Division 

1 1 . Roles and Responsibilities: 

(U) See the Digital Evidence Policy Implementation Guide. 
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1 2. Exem ptions: 

(U) See the Digital Evidence Policy Implementation Guide. 

1 3. Supersession: 

(U) See the Appendix C of the Digital Evidence Policy Implementation Guide. 

14. References, Key Words, and Links: 

(U) 14.1. See the Digital Evidence Policy Implementation Guide. 

(U) 14.2. See the FBI Domestic Investigations and Operations Guide (DiOG) . 

1 5. Definitions: 

(U) See the Appendix E of the Digital Evidence Policy Implementation Guide, "Definitions and 
Acronyms." 

16. Appendices, Attachments, and Forms: 

(U) See the Digital Evidence Policy Implementation Guide. 
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Stakeholder Executive Approval 
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(U) GENERAL INFORMATION 

(U) Questions or comments pertaining to this policy implementation guide can be 

directed to: 

(U) Federal Bureau of Investigation Headquarters (FBIHQ) /Operational Technology 

Division 

(U77FOB©4Division Point of Con tact: Section Chi ef, Digital Evidence Section 
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(U) SUPERSESSION INFORMATION 

(U) Document supersedes (See Appendix C). 

(U) Document is a new publication; no previous versions available. 


(U) CAVEAT 

(U) This policy implementation guide is solely for the purpose of internal Federal Bureau 
Investigation (FBI) guidance. It is not intended to. does not. and may not be relied upon 
to create any rights, substantive or procedural, enforceable by law by any party in any 
matter, civil or criminal, nor does it place any limitation on otherwise lawful investigative 
and litigative prerogatives of the Department of Justice (DOJ) and the FBI. 

(U) fc\W ENFORCEMENT SENSITIVE ; T he information marked (EWfcE&Un this 
document is the property of the FBI and is for internal use within the FBI only. 
Distribution outside the FBI without Operational Technology Division authorization is 
prohibited. Precautions must be taken to ensure this information is stored and/or 
destroyed in a manner that precludes unauthorized access. Information bearing th e LES 
caveat may not be used in legal proceedings without first receiving authorization from the 
originating agency. Recipients are prohibited from subsequently posting the information 
markeThfcES-on a Web site on an unclassified network. 
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1. (U) Introduction 


1.1. (U) Purpose 


(U/ /FOUQ ) This policy implementation guide (PG) establishes and consolidates the 
policy and procedures for the proper handling, reviewing, and processing of digital 
evidence (DE) for the Federal Bureau of Investigation (FBI), whether it is seized, 
received, or otherwise legally obtained. Digital evidence is data that is obtained with the 
intent to assist in proving or disproving a matter at issue in a case or investigation and is 
stored or transmitted in binary form. Digital evidence includes binary data stored on 
magnetic, optical or mechanical storage devices including but not limited to integrated 
circuits, microcontrollers, chips, tapes, computers, cell phones, compact discs/digital 
video discs (CDs/DVDs), flash drives, random access memory (RAM), magneto optical 
cartridges, USB micro storage devices (commonly known as "thumb drives"), digital 
video recorders (DVRs) or other electronic devices that store or process data digitally. 
The Operational Technology Division (OTD)/Digital Forensics and Analysis Section 
(DFAS) is responsible for the FBI’s DE Program and establishing DE policy. 


(U/ / F OUQ )-Except as noted below, this PG applies to all DE obtained or acquired by the 
FBI in connection with an investigation. 


(U//FCrue-) This PG does not apply to digital evidence obtained through: 




(U//FOUQ1 


(U//FQUq 


(U//E O [J O q~I n fo rmat i o n originally obtained in a non-digital format that was later 
converted to digital form to facilitate storage, retrieval or search/query. 


• (U/7¥ i ©UQ)LSpecialized evidentiary information or data collections regulated by 
another PG (e.g., digital fingerprints, digital DNA profile databases). 


• (U//FOUO ;-B us incss. transactional, or other records obtained through a subpoena 

that were provided in digital form. 

(U/7F0UGLUtjlowever, if exempted records are later submitted for a forensic examination, 
this PG would apply to the examination of said materials. 


1.2. (U) Background 

(U/TPOUQiAs computer technology has advanced over time, digital devices have 
bec ome universally used to include indiv iduals, groups, or organizations violating federal 
law DE is ever-present in FBI investigations and 

operations. Ait personnel mat encounter DE must understand how to properly handle, 
review, and process DE to avoid damaging the integrity of the evidence or violating the 
Constitutional rights of a person during the course of an investigation. 

(U/yPOTJ O^The FBI requires that DE be seized, searched, stored, copied, processed, 
reviewed, examined, analyzed, presented, and disposed of in a scientifically proven and 
legally defensible manner to maximize its integrity, authenticity, probative value, and 
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evidentiary reliability, and to facilitate the DE's admissibility at trial or other adjudicative 
proceeding. DE is malleable and can be easily altered or destroyed (e.g., by viewing or 
copying files without following the proper procedures or by variance in temperature or 
exposure to heat or magnetic fields). Utilizing properly trained personnel, established 
procedures, approved tools, and an appropriate quality assurance (QA) program 
maximizes the reliability and integrity of DE for the purpose of authentication and 
presentation in court, as well as for investigate 

1.3. (U) Scope 

(U//FOUQAI h is PG applies to all personnel working for or with the FBI, including FBI 
employees, contractors, detailees and task force personnel assigned to FBI field offices, 
FBI headquarters (FBIHQ) divisions, legal attache (Legat) offices, regional computer 
forensics laboratories (RCFLs), and joint task forces (JTFs) who encounter, handle, 
review, or process DE. 


(U//FOUO//LES>This PG addresses the handling, processing, and content review of DE 
Handling includes procedures related to on-scene search and seizure, transportation and 
storage, evidence intake, and shipping. Processing of DE includes detailed procedures 
related to on-scene preview, imaging, memory capture, conte nt review, search, 
extraction, report preparation, and advanced technical analysi 


container( s) in accordance with the scope of legal a uthority. 

1.4. (U 


~1 Tonic, n< review i.sJJie viewing of the 
digital evidence 


(U//F©UCU.Unless expressly stated otherwise, this PG applies equally to criminal 

IFBT personnel should coordi nate questions concerning 


egal 

authority required] Jwith their chief division counsel 

(CPC) or assistant division counsel (ADC) or with the Office of the General Counsel, 


1.4.1. (U) 

(U//EQmJ~ 
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(U/7F©HO^ However, investigative personnel may review or analyze evidence seized 
under the authority of a criminal warrant or consent when the evidence at issue has been 
determined to be within the scope of the criminal warrant or consent pursuant to which it 
was seized. FBI personnel should not expand the search beyond the consent or criminal 



1.4.2.1.L (U) Use of Analytical Tools or Database Systems to Review or 


Examine DE 



b3 

b7E 


b3 

b7E 


3 

UNCLASSIFIED/7TOU©/fcES^ 






UNCLASSIFIED/Tftree&^S^ 

(U) Digital Evidence Policy Implementation Guide 


( L7/ EQUO LB cforc uploading DE sei/ccf 



I.4.2.2. (IJ 

(U//P0tJQQi Often during reviews or examinations of d£ 

I ( w hen providing technical assistance to the 
Imay be employed in accordance with 


FBI) 



(U//FGUQJ When this circumstance applies, th e case ag ent is responsible for notifying 


and coordinating with his CDC/ADC and OGC 


To ensure appropriate disclosures 


are made, case agents must coordinate with the AUSA or DOJ Trial Attorney. 
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2. (U) Roles and Responsibilities 

2.1. (U) Digital Evidence Roles 

(U/tT' OLIO) -T he FBI’s DE Program divides DE work functions into general categories or 
levels based upon the type and complexity of work performed at each level, and the 
training and experience required of FBI personnel to competently perform the duties at 
each level. Each category of work depicted in Figure 1, below, has its own set of training 
and procedural requirements. The first tiered category requires less training and fewer 
procedures, while the upper two categories require more training and expertise as well as 
more involved procedures. 



:• :• :• 

Jwwwl 

1: Dli Handling, Preview, Seizure, 

111 Revi dl (||. 




Ffeure 1: tl-TFUHJOil 




(U//P0tf0^-The first tiered category on the pyramid represents the broad population of 
FBI personnel who, with minimal training, are authorized to handle, preview, seize, 
and/or review DE content. The second tiered category represents a smaller population of 
FBI personnel who have been trained to the technician level, which allows them to 
image, search, find, and extract DE. The FBI considers the search and find function an 
investigative, as opposed to forensic, process, but the imaging and extraction remain 
forensic processes that require training to forensic standards. The third tiered category 
represents the smallest population of FBI personnel who have received extensive training 
and possess the requisite experience necessary to complete the most technically complex 
DE examinations and analysis. 


(U//F©L^GLl4s used throughout this PG, references to training and certification refer to 
training and certification provided, approved, or recognized by the OTD. Digital 
Forensics and Analysis Section (DFAS). Similarly, unless expressly stated to the 
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contrary, personnel authorized in any tier must comply with the OTD/DFAS approved 
training, follow OTD/DFAS approved policies, procedures, and protocols, and only use 
tools and/or devices in accordance with this PG and OTD/DFAS policies. 

(U/TFOUOl Fevel 1: The handling of DE for seizure or evidence control nurno ses. and/or 

the preview or review of DE content for investigative can be b7E 

performed by personnel such as evidence control technicians (ECTs), special agents 
(SAs) and analysts with proper training and approved tools under procedures approved by 
OTD/DFAS. 

(U//FOW©ALevel 2: DE technician level work can be performed by the following 
personnel (who can also perform Level 1 work) under procedures approved by 
OTD/DFAS: 

• (U//F0WCD Computer Analysis and Response Team (CART) technician (CART 
tech): Personnel trained and certified to forensically copy or image DE. 

• (U//F OU Q4 Digital extraction technician (DExT): Personnel trained and certified 
to copy or image DE and perform simple search/find/extract processes on copies 
of DE. 

• (U//FOWO^J H 'ield Audio Video Program (FA VP) forensic analysts (FAs): 

Personnel trained and certified to perform basic forensic functions related to audio 
and video DE. 

(U//F0UO1 Level 3: Advanced technical analysis is conducted by the following 
personnel (who can also perform Level 2 and Level 1 work): 

• (U//F©fcICLLCART forensic examiner (CART FE): Headquarters or field 
personnel, typically assigned full time to DE work, who are trained, equipped, and 
certified to copy or image DE, search/find DE, extract data from DE, and provide 
opinions related to DE, computer forensics, computer or electronic device 
operations, and other related fields, as their expertise and training permit. 

• (U//FQU Q jXART trainees: Prior to achieving CART FE certification, personnel 
seeking experience and proficiency in the CART Program are considered trainees. 

While in trainee status, these personnel are authorized to perform forensic tasks 
under the supervision of a certified CART FE: 

o (U//TOUO ) CART on-the-job trainee (OJT): Personnel identified by field 
office management to participate in training with a commitment toward 
becoming certified CART FEs. 

o (U/7FOU O-f-CART forensic examiner trainee (FET): Personnel assigned to 
work 100% of their time toward CART FE certification. Typically, these 
are trainees hired into information technology specialist - forensic 
examiner (ITS-FE) positions. These may also be CART OJTs who are 
near the end of their training and have committed 100% of their time to 
CART FE work. 

• (U//F0tJQ) Regional Computer Forensics Laboratory (RCFL) associate 
examiner: Former certified CART FEs from an agency participating in the RCFL 
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b7E 


program who have completed their commitment to the RCFL and returned to their 
home agency, and who continue a relationship with the RCFL to maintain 
certification and training. When serving in this role, RCFL associate examiners 
must continue to be impartial forensic scientists, and are prohibited from 
conducting investigative activities. 

• (U/7F©yCD Computer scientist-field operations (CS-FO): The CS-FOs are 

experienced computer scientists who work as integral members of an investigative 
team supporting FBI investigations an d operations. The CS-FQ is responsible for 
providing advanced technical analysis 

The 

CS-FO is not authorized to engage in 

Additionally, because CS-FOs are part of the investigative team, they are 
prohibited from performing forensic examinations of DE. 

• (U//FtTBQ^OTD/DFAS engineer/analyst/forensic examiner: DFAS 


(U) Table 1 depicts the various DE personnel roles and the functions that they are 
authorized to perform with the proper training and certification. 







(U) DE Handling 





Preview 

Seizure 

Content Review 

t/ 


l/ 


(U) Imaging 



l/ 
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(U) Search/ Find/ Extract 




l/ 

(U) Advanced Technical 
Analysis 

(U) Role-specific SOPs 








2.2. (U) Digital Evidence Responsibilities 

2.2.1. (U) All FBI Personnel Who Handle, Content Review, or Process DE 

(U// FOUQ -) All FBI personnel who handle, content review, or process DE, in addition to 
the specific responsibilities delineated below due to their position, are responsible for: 

• ( U //FOt+Q 4 - U n ders tand i n g and complying with the legal authority as it relates to 

the DE processed, handled, or content reviewed. 


• (U//F©UQXHandling, content reviewing, and processing DE and documenting 
those actions in accordance with this PG, other applicable OTD/DFAS policies 
and procedures, and applicable QA standards. 



• (U/7^ 1 ©CIQjJ3nsuring that all DE is handled, stored, content reviewed and marked 
in accordance with FBI dissemination marking policy (e.g., grand jury [GJ] 
material and tax information) and OTD/DFAS policy (e.g., child pornography 
materia 

• (U//Ft>KQ) Maintaining the chain of custody of all DE. 

• ( U // F0 U O ^-Disseminating DE only in accordance with this PG. 

• (U//F0fcIQ) Providing testimony, as required, in any legal proceedings in 
accordance with this PG. 

2.2.2. (U//fTHSQ£ Investigative Personnel and Analysts 

(U/7F©tJQ^Investigative personnel handling, processing, and performing content review 
of DE (typically special agents and analysts) are responsible for: 

• (U//F©fcfQ)X on ducting and/or directing the preview and/or review of DE 
content. 
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• (U//F6UQ) Using approved DE tools for which approved training has been 
completed. 

2.2.2.I. (U//FmJQ) CART Techs 

(U//FOUQ4-CART techs are responsible for imaging DE using only approved tools and 

techniques. 

2.22.2. (U//F0&Q} DExTs 

(U//FOUO) DExTs are responsible for: 

• (U/TFOtiQj Processing images of DE to search, find, and extract items of interest 
from the DE within the defined scope of legal authority. 

• (U//FOUQUJf certified, and upon request, performing the DE functions authorized 
for CART techs as described above. When performing these functions, the DExT 
must follow the protocols and limitations prescribed for that role. 

2.2.2.3. (U//F04IQ1CART FEs 

(U//FOUQACART FEs are responsible for: 

• (U//FCrtf0)4Jpon request, performing any DE functions authorized for a CART 
tech or DExT. When performing those functions, the CART FE must follow the 
protocols and limitations prescribed for those roles. 

• (U//POUQ) Conducting and/or directing the forensic examination of DE 
including: 


> (u77mioj 



) (U//FOUQ) 



o aj//mwd 




• (U//FOIIQI 

} 

• (U//FQUO) 

in accordance with all 


provisions of this PG and relevant OTD/DFAS quality assurance (QA) 
requirements. 


• (UT/FOEIQ^ Providing 

execution of search warrants and preview/examinations of complex computer 
systems or situations. 

• (U//FOUQ) Providing on-scene consultation with investigators and prosecutors in 
the development of strategies for the seizure or on-scene imaging of digital media 
and equipment. 

2.2.2.3.I. (U// FOUO) F ield Audio Video Program (FAVP) Forensic Analysts 
(FA) 

(U//f*©C[Q) FAVP FAs are responsible for: 
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• (U//F QUO ) Conducting and/or directing the content review of audio and video 


DE. 


’ (U//FQLIQ 



1 1 


> (U//FOWQ1 



• (UffFOgQj 

2.2.2A. (U// FOUO ) Computer Scientists-Field Operations (CS-FOs) 

(U) CS-FOs are responsible for: 


• (U/ /FOU O t -Performi ng any function carried out by a CART tech or DExT related 
to DE. When performing those functions, the CS-FO must follow the protocols 
and limitations prescribed for those roles. 


• (U//F QUQ ) Supporting investigativ e ~| personnel with computer 

science expertise in support of cases or investigations (e.g., assistance with 
interviews and searches), as authorized by this PG. 




(UZ/FeWQ) Usind 


for all activities. 


2.2.2.5. (U) RCFL Personnel 


(U/TFOUQ^RCFL personnel are responsible for performing duties as outlined in the 
MOU between their agency and the FBI. 


2.2.3. (U) FBI Headquarters (FBIHQ) 

2.2.3. 1. (U) FBIHQ Operational Divisions 

(U//FO«aiTlie executive management of FBIHQ operational divisions is responsible 
for: 


• (U// FQUQ ) Communicating the DE policies, procedures, and guidance set forth 
in this PG to personnel within their mission area by posting a link to this PG on 
their respective division websites. 

• (U//F©yGL) Ensuring compliance with all matters identified in this PG. 

• ( U //TT^yQ^JVI o n ito ri ng compliance and reporting non-compliance in their 
respective mission areas in accordance with DIOG guidance on compliance and 
non-compliance. 


2.2.3.1.1. (U) FBIHQ Operational Divisions Routinely Handling DE 

2.2.3.1.1.1. (U//FO^ef 


(U//F0tfQ — 
for: 


DExT personnel who are responsible 


• (U//FtTHQ^ Serving as 
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• (U//FQUQ)| 


• (U//FOU©-) Following FBI DE protocols applicable to DExTs, as specified in this 

PG. 


(U//F DUO J - 


tII//EBJKQ) At the request of the case agent or headquarters program manageme nt 
unit and with the approval of OG< 


(U//FDf50^At the request o f the case agent or headquarters program management 
unit and with the approval o| 


(UZ/FOIid" 


2.2.3. 1.1. 2. (U/7F0«Q) CID/Violent Crimes Against Children (VCAC) Section 


(U//F0UQ) Criminal Investigative Division/ Violent Crimes Against Children (VCAC) 

Section provides l , 

abuse and exploitation to children which may be investigated under the jurisdiction and 
authority of the FBI. The OTD/DFAS/Digital Analysis and Research Center (DARC) 


(U//FOUO) VCAC manages several programs including the Innocent Images National 
Initiative (IINI). 


(U//F0tiQj VCAC is responsible for establishing guidance for the handling of child 
pornography contraband for the IINI program. 

2.2.3.I.I.3. (U//F OUO -> OTD/Digital Forensics and Analysis Section 

(U//FOyQiThe Operational Technology Division (OTD)/Digital Forensics and Analysis 
Section (DFAS), in coordination with other FBI divisions, is responsible for: 


• (U// renting and maintaining policy and procedures for the FBI’s DE 

Program, wherein such policy and procedures ensure compliance with governing 
legal authorities, with regard to the manner in which DE is searched, processed, 
stored, accessed, used, and disseminated, to maintain the integrity of the evidence 
and to ensure adherence to applicable privacy and civil liberties laws, policies, 
and regulations. 


b3 
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• (U//F OUQ 4 Overseeing the FBI DE field subprograms, which include: 

o (U//FT>KQ) Computer Analysis Response Team (CART) Forensic 
Examiner (FE) subprogram. 

o (U//FU U OrDigital Extraction Technician (DExT) subprogram. 

o (U//FOtJO) Computer Scientist - Field Operations (CS-FO) subprogram. 

o (U//F OUO) Field Audio Video Program (FA VP) subprogram. 

o (U// FQUO ) FBI Digital Evidence Faboratory (DEE) and Quality 
Assurance Program for DE. 

o (U//F0CLQ_) Regional Computer Forensics Laboratory (RCFL) 
subprogram. 

• (U/TFOyO^uProviding the following capabilities and resources: 

o (U//FOt^QX Trained examiners who provide DE acquisition, preservation, 
processing, review, examination, presentation, and testimony. 

o (U//F0G41) Trained personnel to provide advanced analysis capabilities 
for DE including: 



o (U//EQUQ) Tr inin g certification, and proficiency testing for personnel 
who process DE. 

o (U//F PUC)| - 

o (U/TFGUqT 
o (U//FOIIQ 

o (U//PQU0|_ 

2.2.4. (U) FBI Field Offices 

2.2.4. 1. (U) FBI Field Office Management 

(El//7T7tT©)-FBI field office management (i.e.. Assistant Director in Charge (ADIC), 
Special Agent in Charge (SAC), Assistant Special Agent in Charge (ASAC), and 
Supervisory Special Agent (SSA)) is responsible for: 

• (U/7POt?©^ Promoting and communicating DE policy. 

• ( U // RTtjO-G^n s u r i n g compliance with this PG. 


b7E 
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• (U77F0WQ) Monitoring compliance and reporting non-compliance in their 
respective mission area in accordance with the DIOG . 

2.2A.2, (U77TO L Ot Evidence Control Technicians 

(U//FOUO) With regard to DE, evidence control technicians (ECTs) are responsible for: 

• (U//F©ttQikProperly storing, protecting, and tracking DE, as described below in 
section 3. 


• (U/7FOfcf0-)-Propcrly packaging and shipping DE, as necessary, as described 
below in Section 3.1. 
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3. (U) Policies and Procedures 


3.1. (U/7FOt^O^Forensic Program Compliance within the FBI 

(U/7F0fcf©4-All DE forensic programs conducted in FBI space must fully comply with 
FBI forensic policies, procedures and requirements as set by OTD/DFAS, and must be 
under the direct and immediate control and supervision of the OTD/DFAS unless prior 
written concurrence of the AD, OTD or his/her designee is obtained. 

3.2. (U) Digital Evidence Handling 

(U//F(TD©^.This section sets forth policy related to the handling of DE for all personnel 
working for or with the FBI, including investigative and technical personnel, ECTs, 
CART techs, DExTs, CART FEs, CSs, DFAS technical experts, FA VP FAs, RCFF 
personnel, and other personnel who encounter DE. 

3.2.1. (U) Personnel Authorized to Handle DE 


(U//FTH4QJ FBI personnel must handle DE for seizure, tran sportation, and si ora pc. as 


with any evidence, pursuant to requirements sp ecified in the| 

| FBI personnel must also be trained and/or 


certified in accordance with OTD/DFAS policy and procedures and follow all applicable 
protocols before processing DE, including making copies or images of DE. 


3.2.2. (U) Pre-Search Considerations 


3.2.2. 1. (U//F0tf0)-Legal Review 

(U/7KH40^FBIHQ and field office personnel must ensure that the seizure and 
examination of DE strictly adheres to the procedures listed in this PG. Personnel handling 
DE may request chief division counsel (CDC) or Office of the General Counsel (OGC) 
legal review of DE-related search warrants and subpoenas as applicabld 

Field 

office CDCs or OGC are also available to provide assistance in drafting search warrants 
or subpoenas for seizing or searching DE. 

3.2.2.2. (U) Timeframe for Warrants Involving DE 


(U//F0WQ) Although Rule 41(e)(2)(A) does not place a specific time limit on off-site 
copying or review of electronic storage media, some judicial districts place specific limits 
on the amount of time per mitted for off-site review. The case agent should consult with 
the CDC or OGC] if there are questions pertaining to time permitted for 

examination. 


b3 
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3.2.2.3. (U) Consent Searches for DE 

(U//FOU O ^-Whenever possible, written consent must be obtained from the consenting 
party and documented on a form FD-26 , Consent to Search or FD-941 , Consent to Search 
Computers. However, this does not mean that oral consent is not valid. The case agent 
must, when relying on oral consent, appropriately document the oral consent on an FD- 
302. 


14 

UNCLASSIFIED //FOUO/LE 5 



UNCLASSIFIED//Frm©/feES^ 

(U) Digital Evidence Policy Implementation Guide 


(U//FOUO) In consent cases, case agents should ensure that! 


(U//fT>UQ) If consent is terminated, the case agent must immediately contact personnel 
processing the DE and notify them of the revocation of consent. Once consent is 
withdrawn, any imaging not completed must be terminated. The case agent should also 
promptly contact the CDC or OGC for advice on how to proceed with searching any 
completed or partial images made prior to revocation. 

3.2.2.4. (U) Requesting Local Field Office Assistance 

(U//F0U07 DExT personnel may provide on-scene support for routine DE handling and 
processing in accordance with the procedures outlined in this PG. DExT support should 
be requested by coordinating with the appropriate squad supervisor(s). 

(U/ / F6 U0) FBI case agents who require search and seizure assistance and/or 
examination of DE must contact their field office CART supervisor, CART coordinator, 
or other CART personnel. 

(U//TOUOl-C'ase agents must submit service requests for DE assistance within field 
offices via electronic communication (EC) to CART personnel. All service requests must 
include: 


• (CT//F QU Q) Case ID - the universal case file number (UCFN) 

• (U//E0UQ) Case title 

• (U//F0UO) Specific request 

• (U//FOCLQ) Description of legal authority 

• (U//F0UCU “CART Operations" in the synopsis field of ECs 


3.2.2.5. (U) Requests Involving Multiple Locations 


(U//FOtJOfjQase agents must coordinate in advance any DE service requests involving 
multiple field offices with the CART supervisor or coordinator in their division as well as 
with the other applicable divisions. If further assistance is required, the CART supervisor 
or coordinator should coordinate with the OTD/DFAS/Forensic Operations Unit (FOU). 


3.2.2.5.L 


(U) Providing] 

Cases 


(Technical Assistance in DE 


(U//FOUQUJhe FBI provides DE forensic services througl] 


(U//FOU0)-Pursuant to 28 CFR § 0.85(g) and the DIOG, the FBI Digital Evidence 
Laboratory (DEL) and RCFLs are authorized to provide, without cost, technical and 
scientific assistance, including expert testimony in federal or local courts, to all duly 
constituted law enforcement agencies, other organizational units of the Department of 
Justice, and other federal agencies. Under this authority, the FBI DEL and RCFLs may 
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also nrovide technical and scientific as sistance, including expert testimony! 


(U//FOU0) The FBI DEL consists of the following units, all of which are components of 
the OTD/DFAS: Forensic Operations Unit (FOU), Forensic Analysis Unit (FAU), 
Forensic Support Unit (FSU), the RCFL National Program Office (RCFL NPO) and the 
Forensic Audio, Video and Image Analysis Unit (FAVIAU). The DFAS forensic 
examiners (see Section 2.1, Digital Evidence Roles) that comprise the DEL consist of 
CART-FEs, CART-FETs and FAVIAU examiners. 

tU//F£ M fO^ The followinp OTD/DFAS units are not comnonents of the FBT DF.T the 

j Field office CART assets and 
laboratories are not part of the FBI DEL. Although the RCFLS follow the FBI DEL's 
quality program, each RCFL is an individually accredited lab independent from each 
other and the FBI DEL. 


(U//F0UC4 In accordance with the DIOG, the provision of routine forensic analysis and 
examination of submitted evidence is considered technical and scientific support. Routine 
forensic analysis and examination of evidence performed by the FBI DEL, RCFLs, or 
CART personnel in field offices is not considered expert investigative assistance (as 
defined in the DIOG), even if those components are providing expert witness testimony 
in connection with the support. 


3.2.2.5.2. (U) Expert Investigative Assistance in DE Cases 

(U//F OUO) FBI personnel, pa rticularly approving officials, must be careful to review 
requests for assistance with PI 



tTT^ntTn^ nnrino Pip course nf nrnviHino pithpr 


b3 

b7E 


3.2.2.5.3. (U) Requests for 


the DEL or RCFLs 


(U//FOUO) FBI components that are not part of the FBI DEL or RCFLs, may only 
provide technical assistance pursuant to Attorney General Order 2954-2008 and the 

DIOG. 


(U//FOUQLRequests fo 

than the FBI DEL or RCFLs must be processed and handled in accordance with the 


DIOG 


as applicable. 
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(U//F OUO ) Requests for RCFL DE support from | | will be handled in 

accordance with the applicable MOU governing the RCFL concerned, provided the MOU 
is not inconsistent with this PG. 

(U//EOUO) Because the authority to provide this support is under 28 CFR § 0.85(g), a 

federal nexus is not required, and such serv ices must be provided at no cost to the 

requesting agency. RCFI 


^s may not provide 

|A11 such requests must be referred to the FBI DEL. 



b3 
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(U//FOUO) The processing of the DE and dissemination of materials and information 
pertaining to the technical assistance by the RCFLs must be in accordance with this PG. 

(U// EOUO) RCFLs will track all service requests, and disseminate information to 



3.2.2.5.5. 

(U//FQUQ) Rfcuuests for the Use of 



(U//FQUQ). Requests for the use of FBI or other 

; in criminal cases 

require the review and recommendation of OGC 

and the DOJ's Criminal Division, 


as well as ap proval by the Deputy Attorney General. See Deputy Attorney General 
Memorandunl 


It I/^FOl JQlI Reciuests for the use oJ 



— n [//bf-mgb j£ho dissemination ol 



b7E 


(U//F0UQ). Prior to approval of a request, assurances must be obtained from the 
requesting agency, as well as the chief prosecutor for the applicable jurisdiction, tha t 


in 


representatives of the requesting agency will not disclose 

court, through pre-trial motions, discovery, or other means, or tnrougn any ledcral or 
state freedom of information legislation or similar law, or otherwise disclose to the media 
or public, without the prior written consent of the Director. FBI, or his designee. The 
requesting agency and the chief prosecutorial official will also acknowledge they are 
receiving the requested technical assistance expressly conditioned on the fact that they 
are subject to the nondisclosure provisions governing FBI information as set forth in 28 
CFR § 16.22, 16.24, and 16.26, as well FBI policy on the protection, use, and 
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3.2.2.6. (U) DE and Evidence Control Facilities (ECFs) 

(U//FDtf©) The original DE seized at a search site must be securely transported to the 

FBI field office or RCFL site and, after processing and examina tion, placed, as 

appropriate, in an FBI or RCFF evidence control facility £ECF) . 

: provides additional guidance 

and requirements. 

3.2.2.7. (U) DE Storage 

(U/ZFOfclQipE must be stored and secured and/or sealed to prevent data or evidentiary 
loss, cross-transfer contamination, or other deleterious change (e.g., DE must be sealed 
and protected from heat and light for preservation). 

3.2.2.S. (U) Shipping DE 

(U//FOFJQ) Shipping of DE from field offices to FBIHQ or RCFLs must be handled 
through an FBI EC F. 

3.2.2.9. (U) Shipping DE to CART 

(U//F0WQ) When it has been determined that DE needs to be shipped either to another 
field office CART FE or to the OTD/DFAS, the DE must be processed through the field 
office's ECT. The ECT must ensure that the DE is packaged securely and that proper 
chain-of-custody procedures are followed. For assistance in packing DE for shipping, the 
case agent should contact the ECT in his or her field office. 

(U// FOfJQfThe DE must be accompanied by an EC requesting examination as desc ribed 
in th j 

3.2.2.10. (U) Transferring a Working Copy of FBI DE 


tU//F0tJQJ Case agents mav submit working copiesl 



may be accomplished by completing a tra 
Recordkeeping Svstem. and providing a \ 

(Submission 

nsmission request EC in the FBI’s Central 

vorking copv of the DEI - 


3.3. (U) Digital Evidence Processing 

3.3.1. (U) Imaging 


(U//F0t£Q9-I m aging is the act of making 
an accurate reproduction of the original E 
DE personnel. Certified DE personnel (i.£ 
FAs) must follow standard CART proced 

copy of the original DE to serve as 

>E. Imaging must only be performed by certified 
j., CART FEs, CART techs, DExTs, and FA VP 
ures and QA requirements when imaging DE. 
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Specific procedures for imaging di gital media are detailed in the 




1 

1 

3.3.2. 

(Uf 





(u//myoL 








3.3.3. (U 




(UZ/FOUOl 








3.3.3.I. 

(U) 



ojzzpqugqL 








3.3.4. (U) Content Review 

iU//~H4UQ) Investigative personnel can review DE for content 
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3.3.4. 1. (U) Scope and the Content Review 


(U//P©EIQCWhen searching DE pursuant to legal authority, an agent is authorized to 
seize only items specified in and responsive to the authority, absent an independent legal 
basis under which materials can be seized or retained. 1 


/aiz/ftreoJ 
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(U/ /FOUO) When searching DE pursuant to a criminal warrant, the warrant permits only 
a search for evidence of a specific, enumerated crime or crimes. Therefore, agents may 
only seize items that are within the bounds of the warrant, commonly known as the 
“scope” of the warrant. 

(17/rf7E-4AjJy¥hcn scarchinc DE I 


government must not exceed the scope authorized in the order. Questions regarding the 
authorized scope of a search should be directed to the servicing legal counsel (CDC/ADC 
orOGC). 

3.3A.2. (U/APTWQl^cope Issues in Consent Cases 

(El//F©feldCWhere consent is the legal authority for a search of DE, the ability of FBI 
personnel to review the digital evidence is bound by the terms of the consent provided. 
Consenting individuals may impose binding limitations on the areas or items that may be 
searched (e.g., specific rooms of a house, specific files or folders on a computer), either 
orally or on the written consent form. 

3.3.4.3. (U//F0&0) Search Protocols for DE 

(U//E OUQ) - A ll FBI personnel should observe all restrictions written into warrants, 
including local protocols attached to any warrants, when examining or reviewing DE. 
Questions regarding such provisions should be directed to the servicing legal counsel 
(CDC/ADC or OGC). 


3.3.4.4. (U) Self-service Kiosks 


(U//FOEK4). Self-service kiosks are provided in most field offices. In addition, portable 
kiosk kits are available in many FBI resident agencies (RAs). When reasonably available, 
investigative personnel must use the kiosks to automatically process supported DE types. 


(U//F9UQI 





self-paced or hands on 


training is required. 



(U//FOUQ-) - 



P hcu-naccu 


or hands on training is required. 


3.3.4.5. (U) When Content Review Is Authorized 

(U/TFOUOj-Content review is authorized only after DE is processed by authorized 
personnel (i.e., CART FEs, CART techs, DExTs, FAVP FAs), with the following 
exceptions: 


(U//F0 ¥a4L 


approved by OTD/DFAS are utilized. 
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(U//F0tJ0> Preview 


OTD/DFAS policy. 


• (U// F Q UO ) Preview by RCFLs or CART field office facilities in accordance with 
OTD/DFAS policy. 

• (U// EOUO) The use of self-service kiosks foi 


(U//FOt^Q) Content review of original DE is prohibited by those not trained and 
authorized by OTD. 


3.3.4.6. (U//F0tKl.. 

(U//F0W€ 



within the scope of the legal authority. The information obtained through 


3.3.4.7. (U 


(U//FQJLIP; 
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3.3.4.S. (U) Content Review Tools 
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(T T// FOFO) All DE content review tools used by personnel working for or with the FBI 
or RCFF in their investigations must be legally obtained and used in accordance with the 
limitations in the licensing agreement, unless a legal exception applies (e.g., fair use or 
specific guidance in the legal authority) and the reviewer has coordinated with his or her 
CDC or OGC. If proprietary software is seized with the data, it may be used to view the 
data from the investigation. 

3.3.5. (U) Documenting Review of DE 

(Fi//F@kJXi]_FBI personnel must document in a report all reviews and searches of DE 

from the point of the receipt of DE through completion of the sear ch, including any 

identification of evidence that fall s within the scope of the warrant 

[ The documentation must be serialized to the 
investigative case file. Such documentation should identify, at a minimum, the general 
nature and manner in which the search of the media was conducted, major steps taken 
during the search, and forensic tools employed during the search. 


(U// EOUO) U ndocumented, "off-the-record" searches or reviews of DE are not 
permitted. The above documentation requirement does not apply to searches of results 
copies (see Section 3.2.6 for definition d 
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(U//FOtJ0)-The four categories of reports are: 


1. (U//FT5tJQ) Content Review Report: Reports factual information resulting from 
the review of DE. 

2. (U//P0yQi DExT Report: Reports factual informatior 


3. (U//F0GO) Report of Examination: Reports the results of an examination 
performed by a certified examiner or other technical expert, usually with 
information regarding advanced analysis or opinions. 


4. (U//FOEfG4- 


3.3.5.I. (U) Content Review Report 

(U//FQ1IQ)^A content review repo rt is a factual report of investi gative findings resulting 
from the review of original, master ' bf the DE. 


The report details who performed the review, when it was performed, 
wnat was reviewed and found, and where it was found. A content review report may be 
documented by completing an FD-302. Content review reports must be serialized into the 
investigative file. A content review report must contain, at a minimum, the following 
information: 


• (U//roU(>rName and contact information of the reviewer. 

• (U// F0UQ ) Description of the working copy reviewed, including case number 
and original DE description. 

• (U// FQ14 0) The physical location of where the review was completed (i.e., 
location of the reviewer). 

• (U//FOUG) The date of the report. 

• (U//FQGQ 4 The methodology and basis for their conclusion 


• (UZ/FOGO)- Report of the responsive content found 


(U//FOUO) All FBI personnel must also fully and officially document in the content 
review report any other ind ividuals who provide substantive assistance (as opposed to 


purely technical assistance) 
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(U//F©tIQ) A content review report must contain only factual information and must not 
contain expert opinions related to the DE, other than those expressly permitted in this 
section and considered to be advanced technical analysis (see Section 2.1, figure 1 ). 

3.3.5.2. (U) DExT Report 

(U//F0UQ) A DExT report is a factual report 

details who performed the work, when it was performed, what was reviewed and found, 
and where it w as found. A DExT report may be documented by completing an FD-302 in 
accordance wit] prescribed by 

OTD/DFAS. DEx i reports must oe serialized into me investigative case file and must 
contain a minimum of the following information: 


• (U//F0tLQj Name and contact information of the DExT. 

• (U// F( - )h f O ) Case identification. 

• (U//FOUO) Name of requestor and specifically what they requested. 

• (U//TOUO* Description of the working copy processed, including case number 
and original DE description. 

• (U//F 0UO )-The physical location of where the review was completed (i.e., 
location of the reviewer). 

• (U/ /EOUO) The date of the report. 

• (U// FOUQ ) List of procedures performed. 

• (U//F0y©^-What was searched for and items found of investigative importance. 

• (U// FOUQ-V Where the DExT is a case agent or investigator, and is reviewing or 

conducting an his/her own case evidence, the methodology and basis for 

his/her conclusioH 


• ( U//F0UQ) Report of the responsive content found, includingl 

• (U//FOUal 


• (U//F©ee4 
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l 


(U//F0tJ©4 What was tan 
which items were targe tec 

leted during the search and, if applicable, the order in 




(U//f'OUQ4-All DExTs must also fully and officially document in the DExT report any 
other individuals who provide substantive assistance 


(U//FOU0) A DExT report must contain only factual information and must not contain 
expert opinions related to the DE, other than those expressly permitted in this section and 
considered to be advanced technical analysis (see section 2.1. figure E) . 

(UZ/FOtfOTIf the DExT is an FBI investigative asset (agent or IA) and is conducting a 
content review and DExT review simultaneously in his or her own case, only a DExT 
report is required. 

3.3.5.3. (U) Report of Examination 

(U//F0felQ} A report of examination is used to report the results 

must be 

serialized into the investigative file. For CART FEs and forensic audio, video, and image 
examiners, the report of examination is required to be documented by completing all 
fields in an FBI 

by OTD/DEAS. Reports of examination must be serialized into the investigative case file 
and must contain a minimum of the following information: 

• (U//F0tfQ) Name and contact information of the examiner. 

• (U//FOU0) Case identification. 

• (U//F0CIQ1 Name of requestor and specifically what they requested. 

• (U/7FOU0-) Description of the working copy processed, including case number 
and original DE description. 

• (U//F0U0-) The physical location of where the review was completed (i.e., 
location of the reviewer). 
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• (U//FOU0-) The date of the report. 

• (U//FOtf0) List of procedures performed. 


• (U//F0tJ04. Items searched for and items found of investigative importance. 

• tl I//FQCI Q ) R eporl of the content found and, 



(U//Ft!WQ) All FBI personnel must also fully and officially document in the report of 
examination whenever they receive substantive assistance from another indivi dual during 
the examination or review process (not including "hcln desk" tvne assistance!] 


(U//FDtf©) Frequently, in the course of the investigation or during trial preparation, an 
examiner is asked to perform additional analysis of the DE. If this occurs, the examiner 
must file a supplemental report of examination, in accordance with the requirements 
above, to fully document the additional analysis requested in accordance with the Federal 
Rules of Criminal Procedure Rule 16. 


3.3.5A (U 

cu//F©yQ. 


Report 


b7E 
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reports must be serialized into the investigative case tile and must contain the 

following information, if applicable: 

• (U//F0¥Q^ Case identification. 

• (U// FQUO > - N ame of requestor and specifically what they requested. 
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(U/7FOUO)-Description of the working copy processed, including case number 
and original DE description. 

(Ei//POEfQ) The physical location of where the review was completed (i.e., 
location of the reviewer). 


(U//FOUCT) The date of the report. 

(U//F©t£Q) List of procedures performed. 

(U//E OUO > - W hat was searched for and items found of investigative importance. 


(E7/FOL1©). Report of the responsive content found, including 


(U//FW91 


(Ui/ECrCuV What was tar geted during the search, and, if applicable, the order in 


which items were targeted 


(U//F0tf9 

report any other individuals who provide substantive assistance with the 

search/find/extraction (not including "help desk" type assistance^ 

| The y must, at a minimum, include who assisted 
them during the processing, and if applicable,! 


(U//F©wd. 


report must contain only factual information and must not 


contain expert opinions related to the DE that would fall within the description of 
advanced technical analysis (see Section 2.1, figure 1 ). 


b7E 



3.3.5.5. (U) Testifying Regarding Review of DE 


(U/7FOUQ) All personnel who handle DE must be prepared to testify concerning their 
findings and actions when seizing, handling, previewing, processing or reviewing DE. To 
facilitate accurate and complete testimony, documentation should be as detailed and 
extensive as necessary to recall all key aspects of their activity. 


3.3.5.6. (U) Retaining Results of Review 

(U/7fO©Q) After the DE is reviewed and/or examined, the set of data that is deter mined 


to be within the scope of the legal authority, relevant, and probative or exculpatory 



-1 

fTT//F77nf i bhThe results of a content review nr examinatior 
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[nay be charged out by the case agent or any other party 
the case agent or case agent’s chain of command. 

3.3.6. (U) Copies 

3.3.6. 1. U) Original DE vs. Master Copy vs. Working Copy 

1U//F O U QQ Digital evidence is unique in that it can, in many cases, be duplicated, or 
imaged] 


(U//F0«O 

authorized 



T&bl$ 




(U/ /EOUQ )-Qriginal DE: DE seized at a search scene or otherwise legally obtained and 
stored in an ECF. If another agency transmits image copies on digital media without the 
original device accompanying it, the original copy received is the original DE copy. 


(U// FOUO ) With the exception of contraband, items subject to statutory forfeiture, or 
instrumentalities of a crime, original DE may be returned to its rightful owners when all 
criminal proceedings have terminated and the CDC and AUSA/prosecutor have 


concurred. FBI personnel who are directed to return original 
of the trial should contact their CDC/ADC and OGCl 


DE prior to the conclusion 
to ensure the proper 


stipulations are entered into to prevent challenges to authenticity after return of the 
media. 


(U/ /FQUQ -)-If the original DE contains contraband and the device was not forfeited, FBI 
personnel should not destroy the entire computer. Instead, the hard drive with the 
contraband should be removed and physically destroyed or contents removed in a manner 
that would preclude recovery. 


(U//F OUO) Ma ster Copy: The one required mmt nf r>F that ie stared on mpHia tn hp 
retained and logged on a chain of custody! 


(U//FOijQ-) Working Copy: 
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1 L 

(IWF©«Q 



(U//F0WQI Restrictions on the tracking, dissemination and copying 


tII//EGWQi A copv of the oriainal lenal anthoritv should be maintained with each 


workina codv of the DE 




(U/7FatJoJ 


(U//EOIjQ^.It is impossible to guarantee that 


33.6.2. (U) Controlling Master Copies 

(U//FQIJQA-A11 master copies must be saved 


phc original legal authority should be maintained with the master copy of the DE. 


(U//EE)UXliJvEistcr Copies may be in two forms: 
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2 . (U/7F0«CL 


(UV/FOUCB-DE received in an ECF marked "master copy” must be assigned a new IB 
number and given a new bar code (as applicable). In the description field, the ECT must 
include the original IB number from which the DE was derived. 

(UAT^QUO-l-To ensure the integrity of the master copy and to prevent unauthorized copies 
from being disseminated, a master copy may only be charged out by DE personnel (i.e., 
CART FEs, CART techs, DExTs, and FA VP FAs). 

3.3.6.3. (U) Protecting Original Evidence or Master Copies 

(U//F OU Q.) Examinations or reviews of DE 


3.3.6.4. (U) Previews of Original Evidence 

(U/TFeUQHn accordance with this PG, FBI personnel may conduct previews of original 
DE. In these cases, perso nnel may only conduct previews in accordance with procedures 
approved by OTD/DFAS | | 



(U//FQIJO) All FBI personnel receiving requests fo must first look to 

the language of the relevant legal authority to determine whether dissemination of images 
or copies of DE is authorized by the court order for the stated purpose 




FBI personnel may 

case Ide and the provision o| 

or mat legal authority is included in the investigative 

is documented as outlined in this section. 

(U//F0t*e-- 

FBI personnel may, with 

OGC approval, disseminate 



uch dissemination must be documented in 
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the case file, as outlined in this section. 
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(U//F0tJ0) Only certified DE personnel (i.e., CART FEs, CART techs, DExTs, FAVP 
FAs, and OTD/DFAS Technical Exp erts') are allowed to make w orking copies. All copies 
made after (or from) the master copy are required to be labeled 

as working copies. 

(U//FDtfQi Case agents must document the dissemination of working copies for tracking 
purposes in the case file. The case agent is re quired to document the ca se agent name, the 
number of working copies provided, recipient! UCFN or file 


number, evidence number, who requested the working copy, date, time, and the purpose 
for the working copy. 


(U//FOUO) At the discretion of the case agent or case agent's supervisor, working copies 
may be submitted to an ECF for chain of custody tracking. In addition, the creation of the 
copy must be documented by the certified DE personnel in the examination file or DExT 
report, as applicable. 

fUZ/F OUQ! The case agent or FBIHO program manager mav disseminate working conies 
of Dll 


(U// EOUO) Because DE may contain contraband, pers onally identifiable information 
(PII). privileged or other legally protected information 


must be approp riately marked [_ 


3.3.6.5.I. (U) Copies of DE for US Attorneys 


(U//FOUO) Only pE shall be provided to USAOs, unless otherwise 

authorized by this section. To obtain a working copy of DE, the USAO must request the 
copy in writing and explain the purpose of obtaining an image or working copy of the 
media. The request must include whether the USAO intends to further disseminate the 
media and, if so, to whom and for what purpose (e.g., to facilitate an exam ination or 
review by non- FBI personnel). In this event, the request should be handled 


request or re-examination request (as outlined below). When reviewing such a request, 
FBI personnel may only comply when the following requirements have been met: 

• (U//EOUO-k-The court order clearly authorizes such a dissemination under the 
relevant circumstances. 


• (U// CQU O) The affiant advised the court that such dissemination would occur 
under the relevant circumstances in the underlying application for the legal 
authority. 

• (U//FOUO) The case agent, in consultation with his or her CDC and OGC j 
determines such a dissemination is otherwise authorized. 


(U//FOUG) Statements in search warrant affidavits or other applications or orders 
ambiguously authorizing the search and seizure of media by "government personnel," or 
similar language, are insufficient to meet the above requirements. For purposes of this 
section, “government personnel” does not include assistant United States attorneys, 
paralegals, or other personnel in a United States Attorney’s Office, or trial attorneys, 
paralegals or other personnel in the Department of Justice that do not meet the definition 
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of a “federal law enforcement officer” authorized to execute a search warrant in Rule 
41(a)(2)(C), Federal Rules of Criminal Procedure. 

(U77EOUO>The above restriction applies in circumstances where the judicial order 
autho rizes the ultimate seizure of only a subset of data that exists on the media initially 
seizedl 


(U/7¥ ; ©UQ^If FBI personnel are requested to provide such copies or otherwise facilitate 
such a transfer, they should inform the unit chief. Forensic Operations Unit, their squad 
supervisor, and their CDC. When personnel comply with such a request pursuant to the 
procedures described above, they must clearly document the details of the request and 
compliance with the above requirements in the agent's investigative case file and, if 
applicable, any digital evidence examination file. FBI personnel also must comply with 
any other relevant policy or procedures, such as the need to obtain the approval of the 
assistant director of OTD for a second examination of digital evidence. 

3.3.6.5.2. (U) Discovery Requests 

(U/7F©fcfO)-FBI personnel handling DE must comply with defense demands for 
discovery. 

(U//F©UQ)jrhe dissemination of working copies of DE to the defense to facilitate a 
discovery request is the case agent’s responsibility. Prior to disseminating working copies 
for discovery, the case agent must protect PII, such as social security numbers, telephone 
numbers, bank account numbers, and medical records in accordance with federal law. 

The case agent must document the provision of discovery copies in the investigative case 
file. 


3.3.6.5.2.I. (U) Providing DE with No Contraband 

(U//F0UQ). The party requesting discovery must either supply suitable (size, quantity, 
and type) media for duplication of the data subject to disclosure or make arrangements 
for replacement of expended media. 

(U//FO UQX.C o pics prepared pursuant to a discovery request are typically 

and must be verified as appropriate for disclosure by the case agent in consultation 

with the AUSA prior to release as discovery. In accordance with DOJ e-discoverv 

guidance, the FBI is under no obligation to creat j 

for discovery. The FBI does 

not provide this service due to the administrative burden and the inabilit y 


b7E 


b7E 


32 

UNCLASSIFIED/ /FOUO/LES 





UNCLASSIFIED/ 7TOUO/LES 

(U) Digital Evidence Policy Implementation Guide 


b7E 


3.3.6.5.2.2. (U) Requests for DE Containing Contraband 

(Fi//F0fcfQ9-When discovery is requested of material containing contraband (e.g., child 
pornography), the FBI must follow the procedures outlined in 18 U.S.C. § 3509(m) the 
"Adam Walsh Child Protection and Safety Act" (the Act). Pursuant to the Act, the FBI is 
required to make reasonable accommodations for the defense to have access to such 
material in an FBI facility specifically configured for these types of reviews, frequently 
called Adam Walsh rooms. Reasonable accommodations include access to the 
government-controlled facility during normal business hours, access to telephones, the 
Internet, and printers. Defense experts may make special, advanced arrangements to use 
the facility outside normal business hours. However, this must be based on a compelling 
need and will not be done as a matter of routine practice due to the fiscal and manpower 
expense to the FBI. 

(U/7FDtJQL)LDefense experts may use their own computers and tools to conduct an 
analysis. However, they must be notified in advance that any digital media entering the 
government facility must be forensically wiped prior to departure in order to ensure FBI 
compliance with the requirements of the Adam Walsh Act. If the field office does not 
have a segregated Adam Walsh room, the chief security officer (CSO) must be notified in 
advance that defense experts may have laptops or other portable electronic devices to 
support the discovery. The case agent must coordinate with the CSO for appropriate 
access. If the defense expert requires more than one session to complete the exam, 
reasonable accommodation may also include that the FBI provide either a lockable, 
private space within the government-controlled facility or a locking safe, in which the 
defense expert may store his or her tools and equipment when away from the room. 

These measures ensure attorney-client privilege and work products are not accidentally 
exposed to the government. 


(U/7F©yQ)Jf a defense expert requests to take any materials generated during the 
examination from the government-controlled facility, all materials must be reviewed to 
ensure that no contraband, law enforcement sensitive (FES), or classified materials are 
included. If the defense expert object s to this re view, CART personnel should notify their 


supervisor(s) and CDC/ADC or OGQ 


r input and assistance in resolving the 


issue. If those parties are not able to negotiate a resolution, the prosecutor on the case 
must be notified to obtain his or her assistance in securing a protective order from the 
court handling the case. It is recommended that the order include, at a minimum, a 
direction to each member of the defense team to individually certify, under oath and in 
writing, that they have taken no materials which are considered contraband under federal 
law away from the government-controlled facility upon completion of the defense 
examination, and that they have not caused any contraband to be sent offsite. 


(U//F OUQ )- If a defense expert represents to the court that it is not feasible to bring his or 
her tools and equipment to the government facility, the FBI may supply forensic tools 
and equipment, including appropriate forensic tool licenses, limited to the forensic tools 
and equipment currently used by the FBI at the time of the request. 
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3.3.6.5.2.2.I. (U) Special Guidelines for RCFLs in State or Local Cases 


(U//F OUQ ) For purposes of handling DE reasonably believed to contain contraband in 
state and local cases, RCFLs should follow the guidelines listed above whenever possible 
to prevent the contraband from being redistributed and the victims re- victimized. 
However, with respect to purely state or local cases, RCFLs are obligated to follow state 
or local court orders governing discovery. 

3.3.6.6. (U | 

3.3.6.6. L (U) Disseminating 


£1 r//FfH4GLLCa se agents may, with the supervisor’s appr ovnl. nrovide conies of the 


to authorized law enforcement, prosecutor^ 

in rurmerance of a lawful purpose and consistent with the terms of the search warrant or 
other legal authority. 


(U//F0GO-) All personnel who handle DE must document dissemina 
copy in the case notes, case report, and CART database, if applicable 

ion of 
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j U//F0tf01 Once s ubmitted to the ECF, the case agent may copy and di sseminate copies 
and associated reports. If the case agent makes copies 


Jie or sne is required to label the media in the same manner as the original (e.g., 


classification markings, banners, file number, and handling caveats). 


3.3.7. (U) Approved Tools 


(U//FOtf0)-Approved tools must be used by all DE personnel during 



(U//F0L1Q) Approved tools for processing DE are listed 

of many approved tools requires successful completion of OTD/DFAS -approved training. 
(U//FtXCf04»In addition to tools listed on the annroved tool list 




(U//FOUQI For each approved version of each tool, the approved tool list provides 
information about the forensic processes for which the tool is approved, as well as the 
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known limitations of the tool. DE personnel are responsible for understanding these 
limitations prior to the use of the tool on DE. 


3.3.7.I. (U) Adding Approved Tools 

(U/TFOtf©.) OTD/DFAS must approve tools in accordance with OTD/DFAS test and 
validation protocol and based upon appropriate scientific and evidentiary criteria. 

(U//POt?Q^»Recommendations to add tools to the approved tool list may be submitted to 
the OTD/DFAS/Forensic Support Unit (FSU). Tool testing, validation, and verification 
must be coordinated through OTD/DFAS/FSU, although actual testing may be performed 
by personnel from other divisions or agencies as approved by OTD/DFAS. 


3.3.8. (U) 


( U//FOUCL1 Case aaents should coordinate with OTD 




|Case agents should be 


aware 1 hat the use of unapproved 

lis di scon raped! 





(U//F©UQ4-When using 




3.3.9. (U) Requests foi 





3.3.9. 1. (U) Examinations of Digital Evidence in FBI Cases 


(U//FO UO)-Except as authorized in this PG (see Appendix E, Examination of FBI 


EvidencJ_ 


FBI criminal 


all evidence gener ated by 


must be 


submitted for forensic examination or forensic analysis to an FBI laboratory or forensic 
program authorized by the FBI Science and Technology Branch (STB). “Forensic 
examination(s)" or "forensic analysis (es)" are either: 


• (U//FOUO 4 Generated as part of a process applied by a recognized forensic 

discipline of the American Society of Crime Faboratory Directors (ASCFD) or b7E 

the ASCFD-Faboratory Accreditation Board (ASCFD-FAB), or the International 
Standards Organization (ISO). 

• (U/7FOUQ.J Commonly described or recognized as "forensic" or otherwise 
relating to the analysis of evidence by scientific or technical means or manner of 
evidence by or through an expert witness, as defined by the Federal Rules of 
Evidence (or their applicable equivalent) or as pronounced by rule or ruling of 
any court or tribunal. 

tU//FQ UQ)l 


3.3.9.1.1, (U) Transfer of Evidence 
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3.3.9.I.I.2. (U) Chain of Custody 


(U//FOUOTIn criminal investigations, once FBI evidence has beenl 



E Hs responsible for maintaining anv chain of custody on all original ; 

md 

created 

derivative evidence 



b7E 


through the examination process until the completion of all trials and appeals. FBI 


personnel may not retain dup licate evidence or samples of evidence 

vithout the prior written concurrence ol the AD, OTD. 


3.3.9. 1.2. (U) Non-Circumvention of FBI Policy 

(U) A referral authorized by this PG may not be used, in whole or in part, to purposefully 
effectuate or passively benefit from activity that would otherwise violate FBI policy, 
including: 



b7E 


• (Ui 


3.3.10. (U) Service Requests in Su pport of Administ rative or Civil Matters 

(FWFOUG) FBI personnel and facilitie j~ I s) may not accept service 

requests to provide DE services in administr ative or c ivil matters. The AD, OTD, may 
grant exceptions after consultation with OGcj | In considering requests for 

exceptions, the AD, OTD must consider: 

• (U) Whether such support would constitute an acceptable use of appropriated 
funds. 

• (U) The i mpact on the FBI of using available examiner and equipment resources 
in support 

• (U) The cost to the FBI in having to provide personnel to testify in a civil matter, 
as well as be deposed and complete other civil discovery. 
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• (U) Other relevant factors presented by particular situations. 


(U//FOtfQ>) These limitations do not preclude providing DE sunnort for FBI internal 
investigation matters, or for RCFFs to provide DE supporf 


b7E 


(U//FtTBO) If the FBI receives civil or administrative legal nrocess (e..p.. a sub poenal in 


connection with DE services performed for a criminal! 
individual served must coordinate with his or her CDC/ADC or OGC counsel 
guidance, as applicable. 

3.3.11. (U) Re-examinations 


, the 
or 


3.3.11.1. (U) Definition of Examination 

(U//POU©}-An examin ation is defined as a forensic process whereby a forensic examiner 
reviews digital evidence 


(U/7POUQ) Examination of data previously reviewed by a DExT is not considered a re- 
examination. 


3.3.11.2. (U) Overview of Re-examinations 

(U//F0E1O)-Unless approved by the AD, OTD as outlined below, examinations are not 
conducted on any evidence that has been previously subjected to the same type of 
technical examination (hereafter referred to as a “re-examination”) 

(U77FOUO-) A re-examination occurs when evidence, already subjected to a technical 
examination 


(U//Fttt*Q) This requirement is intended to: 

• (U77F©yQ)LEliminate duplication of effort. 

• (U//FOUO) Ensure that the integrity of the evidence is maintained. 


(U//F©t*©4 - 


o 

(U//PUUU] 
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o (U//F9UQ' 


o (U//EQUQ4 





3.3.11.3. Requesting a Re-examination 


(U// FOUO) - W ithin the FBI, re-examinations may only be requested by an EC approved 
by the requesting field office's division head. ECs should be addressed to the AD, OTD, 
and be routed through the chief. CART-FOU and the, annronriate CART Field Onerations 


Program manage] 






(U//P©tJO) The request should include a letter from the United States Attorney (or 
District Attorney if a state or local case), containing: 


• (U//F QUQ -) The extraordinary circumstances compelling the requested re- 
examination. 

• (U//TOU0-) A detailed explanation of the facts and circumstances surrounding the 
request. 

• (U//FOWO) All existing service requests. 

• (U//F0UGL) All existing legal authorities. 

• (U//EGlUQ)^A 11 prior examination results, notes, and reports pertaining to the 
previous examinations or reviews, or an explanation as to why this material is not 
available. 

(U//FQUQ) In the event of exigent circumstances 


3.3.11.4. Approval of Re-examination Requests 

(U/7F0UQ) Upon receipt of a request for re-examination, the chief, CART-FOU will 
review the request and supporting materials to determine if a particular examination 
request is a re-examination for the purpose of seeking the AD. OTD's approval. 

(U//FOUQ) After the chief, CART-FOU determines that the requested examination is a 
re-examination, he or she prepares a recommendation of approval or denial for the AD. 
OTD that considers the following factors: 

• (U//F©UQuScope of the requested re-examination. 

• (U//FOU Q q Responsiveness of the prior examination to previous and current 
service requests or legal authorities. 

• (U/7F0UCU.Type of tools used in the prior examination or review (e.g., generally 
accepted forensic tools). 
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• (U/7FOUO i-Location of agency and type of facility that perfomied the prior 


examinatio 

in or review 

i 





• (U//F©tJQl Nature of prior review or examination (including whether prior 
examination substantially followed or were analogous to FBI CART SOPs). 

• (U//FDtf©^»Whether documentation of prior examination or review provides 
sufficient detail (including whether there are indicia of a completed examination, 


• (U//Ft>WQ) Background and certification of previous examiner. 

• (U//F©yO) Purpose of previous review or examination. 


(U//F0E1Q.) The AD, O TP will consider the request for re-examination and, after 


coordination with OGC 


as needed, approve or disapprove the request. Notice of 


approval or disapproval of the re-exa mination request will be transmitted vi a EC (to FBI 
field offices or headquarters divisions If approved 

and if required by the circumstances, the approval document may also outline any 
conditions or limitations placed on the re-examination. The approval documentation will 
be maintained in the examination file. 


(U// EOUQ L) Questions regarding whether a service request constitutes a re-examination 
should be directed to the appropriate DFAS unit. 


(U//FOU0) The cas e agent must mak e all necessary notifications to the prosecutor 


concerning potential |_ 
examination. 


that is or may be created as a result of the re- 


3.3.12. 

jut 


(U) Advanced Technical Analysis 


ilUiii; 


B Advanced technical analysis of DE mav only be performed bj 


3.3.12.1.1. 


in 


(U//F0WC4Jlequests for advanced analysis must be made via a service request. All 
service requests must be do cumented via E C or, where available, an automated request 
through the approv ed QTD / j , using an open FBI case file, or by a request 

o the field office or RCFL. 


for assistance from. 

3.3.12.2. (U// FOUO//LEs j 
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3.3.12.3. (U) Forensic Audio Video Image Analysis 

(U//rOUO>All requests for advanced forensic must be 

submitted to OTD/FAVIAU via EC or other appropriate documentation identified by 
FAVIAU. 


3.3.12.3.1. (U//F OUO//LES 



3.3.13. (U) Assigning Requests to Examiners and DE Backlog Definition 


(U77F©tl©) In order to more accurately assess backlog of DE requests, the backlog is 
defined as "any unassigned request that is over 30 days old." To ensure an effective and 
efficient workflow, supervisors should assign service requests as examiners become 
available to actively address the request. At no time should a service request be assigned 
to avoid being identified as backlog. 


(U//FOtf0q.The goal is to more accurately track digital forensic backlog by identifying 
requests that the field office does not have the resources to address. To further facilitate 
an accurate accounting of backlog, service requests should be limited to no more than ten 
unique items. The case agent or requestor should list ou t the items in the service request 
and rank them in order of priority to their investigation.! 


(U//FOUO) Service requests can be entered directly into the CART database by the case 
agent or by CART personnel on behalf of the case agent. Service requests entered by 
CART personnel into the CART database must be inputted within one business day of 
receipt, regardless of other proprietary software/databases used to manage service 
requests in individual field offices and RCFFs. 
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5. (U) Recordkeeping Requirements 


5.1. (U//FOUO) FBI Central Recordkeeping System 


(U//FOUO)-DE must not be serialized into the FBI's central r ecordkeepin g system or any 
other FBI administrative or records m anagement system (e.g., The FBI’s 


central recordkeeping system (currentF 
system for all case file management. Non-record 


|) is the FBI's official recordkeeping 
materials, per the legal definition of 


federal records, must not be placed in the case file or case file system. Non-record 
materials include any copies preserved for convenience or reference. Though the FBI’s 
central recordkeeping system has the ability to accept many documents and file types as 
either a serial or an attachment to both electronic communications (ECs) and forms, 
current policies dictate the guidelines for what material is authorized to be placed in the 
FBI’s central recordkeeping system. All original digital evidence (IB) and EFSUR 
evidence (ID) must be maintained and handled per evidence procedures and guidelines, 


b7E 



5.2. (U) Additional Guidance on Recordkeeping and Forms Use 


• (U) FQU-Intranet web site: 


• fTH nFT Hualim Accnranpp Tnfrunpt wpb citp- 
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Appendix D (U): Definitions and Acronyms 


(U) Defined Concepts 


(U) Seizure vs. On-scene Imaging vs. Processing 


U//EOUO) There is often a great deal of digital media at a search site. Because 
processing and reviewing this media consumes valuable FBI resources, it is important to 



|f is important to know that imaging is a time-consuming process that 

may take hours or days depending upon on the amount of data to be copied. 
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(U) Imaging (Copying) DE 

(U/TPOtf©) DE is an unusual kind of evidence in that, in most cases, it can be copied 
many times witho ut degrading the original evidence. Most computer users are familiar 
with copying files 


(U/TEOkLOWn order to preserve and maintain the original evidence as it was found 


(U//FOt=IQ) To prevent cross contamination! 


(U//F0tIQ|The above processes related to 
standard operating procedures (SOPs). 


Described in the CART 


(U) Definitions 

(U//FS«Qi Approved Tools - Tools that have been successfully tested and validated for 
processing DE or are native applications and utilities necessary for viewing files with 
proprietary formatting. Approved tools are listed on the OTD Intranet website. 

(U//F©fc!Qi£oniputer Analysis Response Team -Technician (CART tech) - 

Personnel trained and certified to forensically copy or image DE. 

(U//EOCLQ) Computer Analysis Response Team Forensic Examiner (CART FE) - 
FBIHQ or n£ld personnel, typically assigned full-time to DE work, who are trained, 
equipped, and certified to copy or image DE, search DE, extract data from DE, and who 
are authorized to provide opinions related to DE in court. 

(U//F0WUXCART On-the-job Trainee (OJT) - Personnel identified by field office 
management to participate in training with a commitment toward becoming certified 
CARTFEs. 


(Ef/7F©yQxCART Forensic Examiner Trainee (FET) - Personnel assigned to work 
toward CART FE certification 100% of their time. Typically, these are trainees hired into 
ITS-FE positions. These may also be CART OJTs who are near the end of their training 
and have committed 100% of their time to CART FE work. 


(U77F©tf©) Content Review Report - Factual report of search/find/extract information 
that details who performed the work, when it was performed, what was reviewed and 
found, and where it was found. 

(Er/7F©t£G). Computer Scientist - Field Operations (CS-FO) - The CS-FO works as an 
integral member of an investigative team supporting FBI investigations and operations. 
The CS-FO is responsible for providing advanced technical analysis, exploiting data 
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(U// TO UQ) Digital Evidence - Data stored digitally on integrated circuits, micro 
controllers, chips, tapes, magnetic media, optical media or other devices that assist in 
proving or disproving a matter at issue in a case or investigation. 


(U//F0WQiPigital Evidence Extraction Technician (DExT) - Personnel trained to 
copy or image DE and perform simple search/find/extract processes on copies of DE. 


(U/7P0fetm. Report of Examination - The official report of examination used by CART 
FEs and Forensic Audio Video Image examiners and other DE technical experts to report 
the results of advanced technical analysis and/o r document opinions formed as a result of 
.diaL..anaL\.si,s-Lcji^D.iiLiLtd.EYidaic.cXiLbi)iatoi-y 


(U//FDtf©^JDigital Evidence/Media Handling - Physical treatment of digital media 
beginning with the initial identification, seizure, packaging, transport, shipment, storage, 
and control. 


(U//F0WQXDigital Evidence Personnel - Personnel who are authorized upon 
completion of FBI approved training in the handling and processing of digital 
evidence/media (i.e., DExT, CART personnel, and FA VP FA). 

(U//F0FIQ//LE^i Digital Evidence Processing - Processing of DE applies to personnel 
who are trained and tested to process DE and includes procedures related to on-scene 
preview, imaging, memory capture, co ntent review, DE search, extraction, preparing 
reports, and advanced technical analysi 


(U//EOUQ Ex amination - Forensic process whereby a forensic examiner reviews 

digital evidencel 

Examinations have a specific scope as defined by the 


supporting legal authority and the service request pertaining to the evidence submitted for 
examination . The legal authority and service request may define the scope of the 


examination 





( UTTF 0 L r O hE x a m inati o n of data previously reviewed by a DExT is not considered a re- 
examination. 


(U//F0¥Q) Expert Opinion - Judgment regarding certain facts or data either acquired 
by an expert’s own investigation, testing, or observations and based on his knowledge. 
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skill, experience, training, or education in a certain scientific, technical, or other 
specialized field. 

(U/ /FOUQ4 Expert Testimony - Testimony of a witness qualified as an expert 
(scientific, technical or specialized field) by knowledge, skill, experience, training, or 
education, in the form of an opinion or otherwise. This testimony is based on sufficient 
facts or data, is the product of reliable principles and methods, and is grounded upon 
principles and methods that have been applied reliably to the facts. 

(U//FTTB‘Q ^~Extraction - DE that has been l 1 

and provided for investigative purposes. 

(U//F^tTO^Eact Witness - A fact witness has personal knowledge of events pertaining 
to a case and can only testify to things he personally has observed. A fact witness cannot 
offer opinion. 

(U//P9EI0) Field Audio Video Personnel (FAVP) Forensic Analyst (FA) - Personnel 
trained to perform basic forensic functions related to audio and video DE. 

(ul 


(U//F©«aiMaster Copy - The required copy o f DE that is stored on media to be 
retained and logged on a chain of custody. This i j ~fc opy of the original 

DE or a logical copy that contains selected files and artifacts from the original DE, such 
as relevant files from a business server. It is important that the original legal authority be 
maintained with the master copy of the DE. If there is a question of whether a copy of the 
legal authority documents can be retained and/or forwarded, contact OGC or local CDC. 

(U//POUO )■ Original DE - DE seized at a search scene or otherwise legally obtained and 
stored in an ECF. 

(U) Random Access Memory (RAM) - A computer system's memory which contains 
contents of recent applications and data so they can be accessed quickly when needed by 
the computer's processor. 

(U// F 0UQ (- R egional Computer Forensics Laboratory (RCFL) Associate Examiner - 

Former certified CART FE from an agency participating in the RCFL program who has 
completed their commitment to the RCFL, returns to their home agency, and continues a 
relationship with the RCFL to maintain certification and training. 


(U//FC)tK) ) Re-examination - A re-examination of DE occurs when data/evidence, 



(U//FUCO? 


- Less than a full copy of the original DE 




(U) Volatile Memory - Memory that is not retained when power is lost to a device. 
(U//EQ4JX I) W orking Copy - Additional full copies of DE derived from the Master copy 


to allow review by personnel working for or with the FBI in its investigations 
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Appendix E (U//EOUO): Examination of FBI Evidence 


(U/TTOUOi As discussed above in section 3.2. 9.1., all evidence generated by FBI criminal and 
nvestigations (including joint investigations) must be submitted for forensic 
examination or forensic analysis to a laboratory or authorized forensic program of the FBI 
Science & Technology Branch (STB), unless an exception to policy is approved in accordance 
with this Appendix. 


(U//F0UQ) In rare instances, the unique demands of a particular case may prompt a USAO, DOJ 
entity, or o ther prosecutorial or investigative agency to have FBI evidence processed, examined 



(U//FDt3GLlThis procedure is separate and distinct from re-examination (as defined in section 
3.2.11.2. above). A re-examination occurs when evidence, already subjected to a technical 
examination, is reviewed for the same probative data of its content, source, origin, and manner of 
creation, alteration, or destruction. 


(U//F0UQ) Further|_ 


]FBI personnel shall follow the guidance in 


section 3. 2. 9. 1.1 regarding the transfer of evidence. 


( U // F0UCU. $ u bj ec t to the referral prohibitions described below (section entitled Mandatory 
Prerequisites and Discretionary Referral Factors), the SC, DFAS, after consultation as d esired 
with an assistan t general cou nsel ( AGCI 
(OGC 


b7E 


may authorize 
certified forensic examiner or 


transfer of FBI evidencel 
laboratory only under the following conditions: 


• (U/ /FOUO) After a determination of the existence of the mandatory prerequisites and due 
consideration and evaluation of the discretionary referral factors described below. 

• (U//FDtf©) After consultation as may be deemed appropriate with the appropriate 
prosecutor and the applicable CDC or OGC supervisor. 


• (U//FOU0) After compliance with the administrative requirements below (section 

entitled Administrative Requirements). 

(U/ / E OUO) - 


(U//F0fe[CU.Within the FBI] |may only be requested via an EC approved by the 

requesting field office's division head. ECs should be addressed to the AD. OTD, and be routed 
through the chief, CART-FOU and the appropriate CART Field Operations Program manager. 


b7E 
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(U/Tf'QUO j-Thc case agent must ensure that the request EC is serialized to the relevant 
investigative case file. This EC must include: 


• (U) The FBI case ID or universal case file number (UCFN). 

• (U) The FBI field office, telephone number and fax number. 

• (U) The FBI case agent's name. 

• (U) The applicable case prosecutor's name, if known. 

• (U) A description of the original evidence to be released. 

• (U) The full name, address and telephone number of 


• (U) A certification that a supervisory prosecutor and CDC have concurred in the request. 

and that the supervisory prosecutor has read and understands the FBI’s policy 


• (U) The full name and position title of the case agent's Supervisory Special Agent (SSA). 


• (U) An acknowledgement from the case agent that he/she understands it is the case 

agent’s responsibility to make all required notifications to the prosecutor concerning 


(U//FOtf©fc_ 


District Attorney if a state or local casej 


] request should include a letter from the United States Attorney, or 



(U//FOUOJ Approvingj 

(U77FQHQ) Mandatory Prerequisites and Discretionary 

(Fi//F©kJXiiThe SC, DFAS must not authorize 


unless the SC affimiatively 


determines that either of the following prerequisites is met: 



b7E 
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Directors - Laborato ry Accreditation Hoard (ASCI, D-LABV or International Standards 

Organization (ISO). I forensic examiner must possess at the time of referral 

and, thereafter, maintain competency certifications(s) and meet proficiency requirements 


applicable to the recognized discipline or sub-discipline that has accredited 



(U//FOtt01 In the judgment o f the SC, DFAS, otherwise be objectively suitable after 
con sidering and weighing each! 


(U//FOCJOT 


(U//F QUO) A^; uming t hat thq 
are met, the SC, 


prerequisites de.sr.rihc.d in Ihr. sr.clinn uhnvr. 



(U#FOtJQ) Breadth of experience,: lhc, nnmhcr and complexify of forensic 
examinations/analyses conducted! 


(U//FQUO) Testimonial experience: the experience! 


(U//TOUU j Report quality: the quantity and quality of written reports produced 


(U//FOUO) Equipment acceptance: 


b7E 


• (U// FQUQ ) Testing and evaluation documentation: whether there exists sufficient test 


and validation documentation on the equipment, tools or material; 



(I [//mi lO ) Written nrntncnl'J 
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documentation adequate to facilitate the repeatability of results by an equally qualified 


examiner. 


died quality assurance system 


o (U/7FQUQ) Annual, impartial, testing -based, proficiency examinations, 
o (U//F QUO ) Peer review of examination results and reports, 
o (U//F0UQ) Random and/or regular external compliance audits. 

• (U/TFOUQQU^egal requirements 

the examiner is employed or conducting forensic examinations has an affirmative 
procedure to evaluate, determine and monitor the ability of the examiner to testify in 
federal court relative to | tr whether there exists 

a process for evaluating the existence of exculpatory information, which, as a matter of 
law, must be affirmatively disclosed, with or without request] I 

• (UZ/FGUilL Law enforcement authority: whether there is a requirement that examinations 
are conducted by personnel employed by federal, state or local law enforcement agencies 
as may be required by law or under the direct supervision of a sworn law enforcement 
officer (see e.g., United States v Shrake, 515 F.3d U.S. 743 (7th Cir. 2008)) or whether 
the examination processes are conducted by an examiner who is a federal law 
enforcement officer or who is working at the direction of a federally sworn officer 
pursuant to 18 U.S.C. § 3105, if applicable. 

• (U//FOUO) Space restrictions: whether the department, agency, or entity under which the 
examiner operates has an affirmative process in place requiring that examinations of 
contraband are conducted in law enforcement controlled space as required under the 
Adam Walsh Child Protection and Safety Act. 

• (U/7FOUO) Contraband: whether adequate controls exist to prevent unauthorized access 
or distribution of contraband pursuant to law (see e.g., child pornography at 28 U.S.C. § 
2252, et seq. or controlled substances pursuant to 21 U.S.C. § 881, et seq.). 

• (U77F0UD) Criminal history/indices check: 


• (U//FOUO) Security requirements: the maintenance of an appropriate security level 
clearance relative to the FBI evidence being examined or analyzed in conformity with 
FBI security policy, as well as the facility and IT system in which the evidence will be 
stored and reviewed that is compliant with FBI security policy and!” 
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(U//FOtfQ4- Occupational safeguard services: whether there is available 






• (U//F(5tf©4J)epth/adequacy of examinati on: whether all necessary examinations, 
routines, and procedures will be conducted 


(federal violations frequently require different elements of proof than do state or local 
violations of the same or similar nature). 


(U//FOfcf©4- Preservation of original/best evidence: whether the examination process 



(U//F6U0) Cost: 





(U//FOLIO) Administrative Requirements 
( U//FOTO4-Prior to initiating a request I 


(U//FOt5Q^ Conduct the examination(s) as well as testify as required at all proceedings 
associated with the case. 


• (U// FQUQ > Conduct all necessary examinations in light of the fact that violations of 
federal law often require different elements of proof than the same or similar state or 
local violations. 


• (U //FQUQ) N ot destroy or impair the admissibility of the evidentiary material 

• (U//F QUO) C onsult either the FBI Faboratory or OTD DEF, as applicable, on scientific 
and technical aspects for the examination, if needed 

• (U/ /FQUQ ) Notify either the FBI Faboratory or OTD DEF if examination will consume 
the evidentiary material. 

• (U//FOtf©) Promptly provide a copy of the examination report to either the FBI 
Faboratory or OTD DEF after the examination is completed. 


(U//FOF K-H The OTD DEF must notify the case age nt of any prior knowledge regarding the 
proposec concerning the examiner’s ability to meet the b7E 

basic standards of practice of the scientific discipline involved in the examination, or the use of 
practices that may call into question the ability to use the evidence and examination results at or 
administrative results at any judicial or administrative proceedings. This contact will be 
documented by the case agent via EC in the investigative case file. 


(U// FOUO ) Referral Prohibitions 


b7E 
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(U//FOHO) Disqualified 

(u//mtfo [ 

• (u//Foee- 

• (uz/gego. 


• (UZ/FOUOVThe FBI has information to believe 


• OJ//FQ U01 


(UZZFOUO)-Second Opinion Examinations 


(U//FOUO] |nay not be used, in whole or in part, to seek or obtain second 

opinions regarding or re-examinations of a forensic examination/analysis or variations of an 
examination/analysis already commenced or completed by an FBI STB laboratory without 
obtaining re-examination authority as described in section 3.2.1 1 of this PG. If authority is 
sought for a second opinion or re-examination, the case agent must notify the prosecutor that no 
testimony should be provided on the same technical subject or area, or regarding the initial 
examination (testimony will be provided for the defense if rennired hv law) The, rase agent must 
make all required notifications to the prosecutor concerning Imaterial that 

is created as a result of the second opinion or re-examination-: 

(UZ/FOtfO 1 )"" Curbstone" or Informal Evaluations or Advice 


(U/7F0yQj may not be used, in whole or in part, to seek or obtain 

"curbstone,' 1 ad hoc, or informal opinions or advice by or from non-FBI scientific or technical 
personnel to assess the potential value of FBI evidence prior to submitting it to FBI STB 
laboratories (e.g., FBI personnel may not provide FBI evidence to a non-FBI scientific or 
technical person to obtain an informal, undocumented or "off the record" opinion on whether it 
should be submitted to an FBI STB laboratory, or what type of examination should be 


(U/7FT)t*Qa 


Investigations Prohibited. 

(U//F0ee 


• 

(U//F0UQ1 
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(U^FDtlGLjLDocumentation Requirements. 


b7E 

1U//EBI4. Q1 Th e SC, DFAS must prepare an EC containing the approval or denial 

request and the case agent must ensure that the EC is serialized to the relevant investigative case 

file. This EC must include: 


• (Ef//TTTtf0^-The date the request was either approved or denied. 
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